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Subject: Guidelines 10/2020 on restrictions under Article 23 GDPR 


Dear Ms. Jelinek, 


ACCIS, the Association of Consumer Credit Information Suppliers, welcomes the EDPB’s draft 
guidance on restrictions under Article 23 GDPR. 


We are broadly supportive of the draft guidelines document. 


There is, however, one concrete aspect that we invite the EDPB to better clarify in its document. It 
should be noted that all alternatives of Article 23(1) allow for restrictions for the benefit of public 
authorities, as well as private entities. Furthermore, a public interest is only required for alternatives (a) 
to (e) whilst the other alternatives can also rely on the protection of private interests. Specifically, 
alternative (j) refers to the rights of freedoms of others and Recital 63 explains that these include, for 
example, trade secrets or intellectual property rights. 


Whilst the Guidelines do not exclude the application of restrictions for the benefit of private entities and 
for private interests, the examples provided in the draft guidelines do not properly illustrate the full 
scope of the right to introduce restrictions. Therefore, we would like to invite the EDPB to add 
examples regarding private entities and private interest to the description of the alternatives of 
Article 23 (1) GDPR, such as restrictions protecting private entities from obligations to the extent that 
they cause a disproportionate effort. 


It should be remembered that Article 23(1) GDPR is similar to Article 13(1) of the Data Protection 
Directive (Directive 95/46/EC) and the basis of broad restrictions under national laws. The wording of 
Article 23 (1) GDPR does not indicate an intention to limit the scope of the provision in comparison to 
the Data Protection Directive, provided that the new requirements in Article 23(2) are met. 

We thank you for your attention and remain available to discuss this issue further. 


Yours sincerely, 


Enrique Velazquez 
Director General 
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